Probabilistic Spying on Encrypted Tunnels
summary
An open-source pacen toolkit trains on labeled pcaps and classifies encrypted tunnels by counting packet sizes in 10s windows, using modified decision trees (with optional Gaussian-mixture baselines). Training often needs ~12 hours of idle capture; evaluation returns probabilities and reaches 99.999% on Skype over SSH in their demo. It works with SSH or OpenVPN pcaps, is fast to train/classify, and the recommended defense is constant-size padding plus fixed-interval sending to remove the size/timing side channel.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:10Expectation-Maximization Algorithm
- 8:23How Does It Work
- 11:29Classifiers
- 13:04Mixed Gaussians
related talks
22mEffective Detection of Multimedia Protocol Tunneling using Machine Learning
14mEndangered Privacy: Large-Scale Monitoring of Video Streaming Services
45mThe Sound of Your Secrets: Teaching Your Model to Spy So You Can Learn to Defend
51mHow to Detect Malware in Encrypted Traffic WITHOUT Decryption
31mCommSec D1 - Steganography Ante Portas
40mUncovering Covert Channels in Your IoT Networks
17mPrivateEye: Scalable and Privacy Preserving Compromise Detection in the Cloud
29mYou Can’t Hide: How a Device Can Give Away a Fraudster’s Secrets.